Wikipedia:Sockpuppet investigations/Knson/Archive

Suspected sockpuppets



 * User compare report Auto-generated every hour.
 * Editor interaction utility

It it seems to me that all four of these IP addresses are tied not only because four have made edit to Randolph family of Virginia, but also (duck) they seem to be interested in family trees and taxonomy (another form of tree) and according to who is they are all from the same ISP.


 * 86.181.49.123 BT-CENTRAL-PLUS	Central + migration to 21CN
 * 86.147.205.25 BT-CENTRAL-PLUS	IP pools
 * 86.134.3.228 BT-CENTRAL-PLUS Central + migration to 21CN
 * 86.147.200.141 BT-CENTRAL-PLUS IP pools

editor interaction

Two of them have been blocked 86.147.205.25 by user:Ronhjones another, 86.134.3.228, by user:KrakatoaKatie and user:Alexf.

There are probably a more IP addresses used by this person that I have not identified. PBS (talk) 10:26, 10 November 2017 (UTC)

More suspected sock puppets added by PBS
editor interaction including Luqmanh and Jmv2009


 * It looks like 86.134.5.22 is a duck and the ISP is BT-CENTRAL-PLUS
 * Please check user:Luqmanh this is an account that has only made 6 edits five of which are to articles the other accounts here have also edited.
 * Please check user:Jmv2009 as there is a high correlation of edits under four days between Jmv2009 and Knson non of them correcting changes made by other.
 * Please check user:Chermundy See my comment below about comments on Template:Animalia. This account has only become active again after only one edit (26 May 2017) since last year. All the recent edits have been to pages that other accounts on this page have been editing interaction between Chermundy and Jmv2009, but because of the high edit count theses may have been to pages on the watch list of Chermundy (so I can not defiantly say it is a duck). This account has more edits than any other (13.5k) but as far as I can tell this account has never made an edit to a talk page (all talk page edits were the result of page moves).

Template:Animalia history shows a number of accounts listed here cooperating including 86.147.205.25 (previously blocked). It also shows Jmv2009 also reverted a revert to an edit made by 86.134.3.228 (also previously blocked).

-- PBS (talk) 12:48, 11 November 2017 (UTC)

Not a sockpuppet, please check again. The Animalia/Template edit by 86.134.3.228 (which was not me) was correct. It got reverted because there was no reason given. I added a reason and reverted the revert.Jmv2009 (talk) 12:51, 11 November 2017 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * - As would be expected with BT, all the addresses are dynamic IP, and geolocate to the BT office in Braintree. Geolocate does not work here in the UK. It may well be quacking, but it is possible that the some of the changes of addresses are just down to BT's dynamic system. I suspect some protections and/or an edit filter will be the only possible control, a range block is unlikely to be big enough without affecting other users. Ron h jones (Talk) 20:55, 10 November 2017 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Based on the edits made to Randolph family of Virginia, this is Knson. Please increase Knson's block to one month for further block evasion. Actually, it seems Knson was created while User talk:86.147.205.25 was still blocked. Please indef that account per WP:NOTHERE, and please block the most recently active IP (86.181.49.123) for a week. Sro23 (talk) 01:00, 11 November 2017 (UTC)
 * Done. NinjaRobotPirate (talk) 11:14, 11 November 2017 (UTC)
 * did you look at the "more suspected sock puppets" listed above? I didn't see that section at first, and I'm wondering if you missed it, too.  I just noticed it because Jmv2009 edited this page after I closed the case. NinjaRobotPirate (talk) 12:58, 11 November 2017 (UTC)
 * Oh, I see. It's new.   please don't edit closed SPI cases.  It causes all sorts of confusion, as you can see.  Open a new case when you have new reports.  I guess I'll re-open this. NinjaRobotPirate (talk) 13:02, 11 November 2017 (UTC)
 * How could I tell it was closed (and as it had not been archived, I could not have opened a new one in the same name)? -- PBS (talk) 13:10, 11 November 2017 (UTC)
 * OK I see the template, trouble was that when I started to prepare and edit the additional section it was before the template was changed to closed. I'll check for that in future. -- PBS (talk) 13:21, 11 November 2017 (UTC)
 * Closing with no action. I'm seeing hardly any similarity among that second group aside from the IP which has gone stale. Sro23 (talk) 09:17, 12 November 2017 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Following a block of Knson3, Steedhals was created and picked-up editing warring where Knson3 left off.  Jump to navigationJump to search Best, Barkeep49 (talk) 01:59, 10 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Both blocked indefinitely, along with 3 months for which is clearly their IP being used for edit warring and vandalism. Ivanvector (Talk/Edits) 14:51, 10 August 2018 (UTC)
 * This sounds like the right thing to do. As noted above, Knson3 was blocked one month per WP:AN3 when they continued right on with their program after a prior 24-hour block. The reason for choosing one month was (a) they seemed to be ignoring all feedback, (b) they were making mass changes to taxonomy articles that could take time to undo. At the time I was not aware of the related IP that Ivanvector found. The IP certainly provides more examples of bad behavior, including their own block log. EdJohnston (talk) 15:04, 10 August 2018 (UTC)
 * See Sockpuppet investigations/Knson. Is this the same guy? If so should the two SPI cases be merged? I'll leave a note for Ivanvector as the clerk and change the status to 'open'. Hope this does not mess anything up. EdJohnston (talk) 17:16, 10 August 2018 (UTC)
 * Yup, no question. Thanks for pointing out that other case. I'm revoking Knson's talk page access, they've only used it this month to make unattributed copies of mainspace articles. Will merge in a moment. Ivanvector (Talk/Edits) 17:50, 10 August 2018 (UTC)
 * Thanks for your reply. Just to set up the sequence of events, I originally blocked Knson3 and his name was entered by Ivanvector into the Knson3 SPI case. Then the comments got copied here (Knson sock case). EdJohnston (talk) 18:19, 10 August 2018 (UTC)


 * - I'd like a CheckUser to take a look at this. and  are also the same user (both already blocked) and Knson has that "obviously somebody's sockpuppet" definitely not a new user feel. Please check for other possible sleepers and/or an older master. Ivanvector (Talk/Edits) 17:55, 10 August 2018 (UTC)
 * All the little Knsons are ✅. Steedhals is . No other accounts seen. Closing.--Bbb23 (talk) 19:21, 10 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

The user is suspected to be a sockpuppet of this account which has been blocked. Both of them have been making edits to the similar articles. Moreover, they have similar names. The user also oreviously had another blocked account SteedhalsKnightrises10 (talk) 16:46, 14 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Blocked. Sro23 (talk) 16:55, 14 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Same habit of copying taxonomy navboxes, etc. onto talk page: 128.189.203.33 (talk) 17:08, 16 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * IP already blocked. Sir Sputnik (talk) 19:23, 16 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Duck - continuing to increase number after name, and edits so far match prev. Request whoever blocks to revoke TPA since Knson uses it to continue whatever taxonomic edits he does Galobtter (pingó mió) 18:02, 19 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Between the username and the similarities between their userpage ad this, . Please block the new sock indefinitely, and revoke talk page access as requested. Sir Sputnik (talk) 23:03, 19 August 2018 (UTC)
 * , talk page revoked. Mz7 (talk) 03:26, 20 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Continuing to increment number after username, continuing to uncommuntively make taxonomic edits. Again request TPA revocation along with block Galobtter (pingó mió) 17:35, 21 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * Ivanvector (Talk/Edits) 18:05, 21 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Continuing to uncommunicatively make unsourced taxonomic edits using outdated phylogenies. As before, request TPA revocation along with block. This is really getting out of hand. Dyanega (talk) 16:08, 23 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * IP blocked and edits mass reverted.-- Jezebel's Ponyo bons mots 16:18, 23 August 2018 (UTC)

Suspected sockpuppets



 * Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

Appear to have tracked down the identity of Knson, and located a number of other accounts that are not blocked yet. Checkuser will hopefully confirm these are all the same user. Dyanega (talk) 17:47, 24 August 2018 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * - Checkuser data is only retained for 90 days (the account hasn't edited in 5 years) and can't be used to publicly connect an account with an IP address. In addition, this ISP uses very wide dynamic ranges so it would be difficult to implement a rangeblock here that wouldn't affect many other users, and so there really isn't anything we can do with this report. Please do continue to file reports if you see any active disruption, we'll address what we can.
 * Also, I don't think you meant it and I'm probably just picking at one interpretation of your comment, but if you're trying to discover Knson's real-life identity, stop right now. That's illegal almost everywhere, and it's definitely not allowed on Wikipedia. Thanks. Ivanvector (Talk/Edits) 18:01, 24 August 2018 (UTC)


 * Thanks. I do understand and support the WP privacy policy, but in cases of sockpuppetry, there's obviously the possibility that during the process of locating sockpuppet accounts, one might come across an account that potentially reveals the puppet master. Given that the privacy policy does explicitly state "Posting another editor's personal information is harassment, unless that person has voluntarily posted his or her own information, or links to such information, on Wikipedia.", this would seem to allow for situations when the master's WP account is linked to the sockpuppets. I would assume that this has to happen with some fair frequency during such investigations. Dyanega (talk) 18:41, 24 August 2018 (UTC)